Re: [RFC PATCH 07/56] x86/bugs: Reset spectre_v2_user mitigations

Borislav Petkov
2025-12-03T17:36:23Z

On Wed, Dec 03, 2025 at 05:02:24PM +0000, Kaplan, David wrote:
> We don't know how tasks are using this prctl(). Maybe the task only sets
> PR_SPEC_DISABLE around one specific function call.
>
> What if a program starts up and queries the kernel and gets PR_SPEC_PRCTL so
> it thinks it can control things. And then it calls
> PR_SPEC_DISABLE/PR_SPEC_ENABLE around one particular sensitive function.
>
> And then at some point, it starts getting -EPERM...

Well, we can't have the cake and eat it too - at some point the admin will
override the setting the task did. There's no other way.

> It would be cleaner if userspace never saw errors, but the mitigation were
> just silently applied/not-applied.

As in: if dynamic mitigations are enabled, kernel stops returning EPERM but
simply overrides the mitigation setting and issues a pr_warn_once() that
PR_SPEC_PRCTL doesn't take effect anymore due to system-wide override?

Works for me...

--
Regards/Gruss,
Boris.